@odla-ai/cli 0.35.1 → 0.35.3

package/dist/bin.js

@@ -174,7 +174,7 @@ function absoluteEntryPath(entryPath) {
 
 // src/bin.ts
 var argv = process.argv.slice(2);
-requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-HS35QLXR.js")).runCli()).catch((err) => {
+requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-ZBNA7J4T.js")).runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });

package/dist/{chunk-SRL2TN24.js → chunk-PYR73XBD.js}

@@ -149,6 +149,29 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
   return interactive ? void 0 : 9e4;
 }
 
+// src/cached-credential.ts
+import { rmSync as rmSync2 } from "fs";
+var noted = null;
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  rmSync2(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
+    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
+  ].join("\n");
+}
+
 // src/local.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
 import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
@@ -294,6 +317,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
       out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      noteCachedCredential(cfg.local.tokenFile);
       return cached.token;
     }
   } else {
@@ -13279,6 +13303,29 @@ function recordInvocation(parsed) {
   }
 }
 
+// src/advisory-output.ts
+import { formatAdvisory, parseAdvisories } from "@odla-ai/apps";
+function advisoryCollectingFetch(inner, sink) {
+  return (async (input, init) => {
+    const response2 = await inner(input, init);
+    try {
+      sink.push(...parseAdvisories(response2));
+    } catch {
+    }
+    return response2;
+  });
+}
+function renderAdvisories(out, advisories, env = process.env) {
+  if (env.ODLA_NO_ADVISORIES) return;
+  const seen = /* @__PURE__ */ new Set();
+  for (const advisory of advisories) {
+    const key = `${advisory.code}:${advisory.message}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.error(formatAdvisory(advisory));
+  }
+}
+
 // src/runbook-actions.ts
 import { readFileSync as readFileSync9 } from "fs";
 var PLATFORM_SCOPE = "$platform";
@@ -13896,7 +13943,7 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join15 } from "path";
 import process15 from "process";
@@ -13933,7 +13980,7 @@ function editText(initial, slug, deps = {}) {
     const edited = readFileSync12(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    rmSync2(dir, { recursive: true, force: true });
+    rmSync3(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -14821,6 +14868,23 @@ async function securityStatus(parsed, dependencies) {
 
 // src/cli.ts
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
+  const out = redactingOutput(dependencies.stdout ?? console);
+  const advisories = [];
+  const withAdvisoryReader = {
+    ...dependencies,
+    fetch: advisoryCollectingFetch(dependencies.fetch ?? fetch, advisories)
+  };
+  try {
+    return await dispatchCli(argv, withAdvisoryReader);
+  } catch (error) {
+    const explanation = explainRejectedCredential(error);
+    if (explanation) out.error(explanation);
+    throw error;
+  } finally {
+    renderAdvisories(out, advisories);
+  }
+}
+async function dispatchCli(argv, dependencies) {
   const runtime = {
     ...dependencies,
     stdout: redactingOutput(dependencies.stdout ?? console)
@@ -15045,4 +15109,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-SRL2TN24.js.map
+//# sourceMappingURL=chunk-PYR73XBD.js.map